# Hard-coded credentials. Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [CodexBar < 0.33.0 Credential Leakage via HTTP Redirect](https://agentprime.io/advisories/CVE-2026-49949.md) `CVE-2026-49949` · CVE record: steipete CodexBar · CVSS 6.0 Medium · Not analysed yet · Published 11 Jun 2026 · Tags: Hard-coded credentials - [Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token](https://agentprime.io/advisories/GHSA-9gw6-46qc-99vr.md) `GHSA-9gw6-46qc-99vr`, `CVE-2026-48039`, `PYSEC-2026-413` · PyPI `meta-ads-mcp`: affected `<1.0.109`, fixed in `1.0.109` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Jun 2026 · Tags: Information disclosure, Authentication bypass, Hard-coded credentials - [@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects](https://agentprime.io/advisories/GHSA-x426-x7cc-3fpc.md) `GHSA-x426-x7cc-3fpc`, `CVE-2026-48022` · npm `@hapi/wreck`: affected `<18.1.2`, fixed in `18.1.2` · CVSS 6.5 Medium · Not analysed yet · Published 11 Jun 2026 · Tags: Information disclosure, Weak cryptography or TLS, Hard-coded credentials, CWE-346 - [Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery](https://agentprime.io/advisories/GHSA-mqq6-462x-jxmm.md) `GHSA-mqq6-462x-jxmm`, `CVE-2026-48031`, `GO-2026-5515` · Go `github.com/dhax/go-base`: affected `<0.0.0-20260517152733-cc82b9740fa6`, fixed in `0.0.0-20260517152733-cc82b9740fa6` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jun 2026 · Tags: Hard-coded credentials - [Visual Studio Code Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-47281.md) `CVE-2026-47281` · CVE record: Microsoft Visual Studio Code · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2026 · Tags: Authentication bypass, Hard-coded credentials, Broken access control - [Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect](https://agentprime.io/advisories/GHSA-pfc9-2cqg-9wq6.md) `GHSA-pfc9-2cqg-9wq6`, `CVE-2026-41715` · Maven `io.projectreactor.netty:reactor-netty`: affected `>=1.3.0, <1.3.6 || >=1.2.0, <1.2.18 || >=1.1.0, <=1.1.31 || >=1.0.0, <=1.0.48`, fixed in `1.3.6`, `1.2.18` · CVSS 6.1 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Hard-coded credentials - [SourceCodester Onlne Examination & Learning Management System import_users.php hard-coded password](https://agentprime.io/advisories/CVE-2026-11552.md) `CVE-2026-11552` · CVE record: SourceCodester Onlne Examination & Learning Management System and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Hard-coded credentials, CWE-255 - [OpenBullet2 0.3.2 NTLMv2 Hash Disclosure via UNC Path Proxy Source](https://agentprime.io/advisories/CVE-2026-39908.md) `CVE-2026-39908` · CVE record: openbullet openbullet2 · CVSS 7.1 High · Not analysed yet · Published 8 Jun 2026 · Tags: Hard-coded credentials - [SourceCodester Barangay Resident Profiling and Information Management System Password Reset passsword_reset.php hard-coded password](https://agentprime.io/advisories/CVE-2026-11515.md) `CVE-2026-11515` · CVE record: SourceCodester Barangay Resident Profiling and Information Management System · CVSS 6.9 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Hard-coded credentials, CWE-255 - [GL.iNet XE3000 glnassys hard-coded key](https://agentprime.io/advisories/CVE-2026-11505.md) `CVE-2026-11505` · CVE record: GL.iNet A1300 and 4 more · CVSS 2.3 Low · Not analysed yet · Published 8 Jun 2026 · Tags: Hard-coded credentials, CWE-320 - [Tenda AC15 Samba smb.conf weak password](https://agentprime.io/advisories/CVE-2026-11493.md) `CVE-2026-11493` · CVE record: Tenda AC15 · CVSS 2.3 Low · Not analysed yet · Published 8 Jun 2026 · Tags: Hard-coded credentials - [Unauthenticated File Exfiltration in Altium Enterprise Server Vault Service via Hard-coded Cryptographic Key and Path Traversal](https://agentprime.io/advisories/CVE-2026-11414.md) `CVE-2026-11414` · CVE record: Altium Altium Enterprise Server · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Jun 2026 · Tags: Path traversal, Hard-coded credentials - [NetMan 204 Hard-coded Backdoor Credentials](https://agentprime.io/advisories/CVE-2025-71317.md) `CVE-2025-71317` · CVE record: Riello UPS NetMan 204 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Jun 2026 · Tags: Hard-coded credentials - [Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService](https://agentprime.io/advisories/GHSA-wv8c-6mx2-xf4j.md) `GHSA-wv8c-6mx2-xf4j`, `CVE-2026-45726`, `GO-2026-5725` · Go `github.com/siderolabs/omni`: affected `>=1.3.0, <1.6.6 || >=1.7.0, <1.7.3`, fixed in `1.6.6`, `1.7.3` · CVSS 7.6 High · Not analysed yet · Published 5 Jun 2026 · Tags: Information disclosure, Hard-coded credentials, Broken access control - [Hardcoded Cryptographic Keys and Weak IV Generation in linqi](https://agentprime.io/advisories/CVE-2026-11347.md) `CVE-2026-11347` · CVE record: linqi GmbH linqi · CVSS 8.5 High · Not analysed yet · Published 5 Jun 2026 · Tags: Hard-coded credentials, Weak cryptography or TLS - [NAVTOR NavBox Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-21404.md) `CVE-2026-21404` · CVE record: NAVTOR NavBox · CVSS 5.8 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Hard-coded credentials - [Hardcoded Cryptographic Key Vulnerability in GX Earth ONT Models](https://agentprime.io/advisories/CVE-2026-45433.md) `CVE-2026-45433` · CVE record: GX INDIA GX Earth 2022 and 1 more · CVSS 8.7 High · Not analysed yet · Published 4 Jun 2026 · Tags: Hard-coded credentials - [Firmware Theft & IMEI Spoofing via Connect-OTA](https://agentprime.io/advisories/CVE-2026-50226.md) `CVE-2026-50226` · CVE record: Acer Connect M6E 5G Portable WiFi Router · CVSS 6.9 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Hard-coded credentials - [Bulk User Private Data Harvesting](https://agentprime.io/advisories/CVE-2026-50213.md) `CVE-2026-50213` · CVE record: Acer Connect M6E 5G Portable WiFi Router · CVSS 8.7 High · Not analysed yet · Published 4 Jun 2026 · Tags: Hard-coded credentials - [Hard-coded AWS Cognito Testing Accounts](https://agentprime.io/advisories/CVE-2026-49204.md) `CVE-2026-49204` · CVE record: Acer Connect M6E 5G Portable WiFi Router · CVSS 6.9 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Hard-coded credentials - [T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 were discovered to contain a hardcoded password for root access under the "superadmin" account.](https://agentprime.io/advisories/CVE-2026-35905.md) `CVE-2026-35905` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Jun 2026 · Tags: Hard-coded credentials - [Hard-coded password in NETAPP Active IQ OneCollect](https://agentprime.io/advisories/CVE-2026-22055.md) `CVE-2026-22055` · CVE record: NETAPP Active IQ OneCollect · CVSS 5.3 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: Hard-coded credentials - [Hard-coded password in NETAPP Active IQ Config Advisor](https://agentprime.io/advisories/CVE-2026-22054.md) `CVE-2026-22054` · CVE record: NETAPP Active IQ Config Advisor · CVSS 5.3 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: Hard-coded credentials - [Weak password policy in ProjectsAndPrograms school-management-system](https://agentprime.io/advisories/CVE-2026-47325.md) `CVE-2026-47325` · CVE record: ProjectsAndPrograms school-management-system · CVSS 6.9 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: Hard-coded credentials - [Mercusys AC12G (EU) V1 with firmware AC12G(EU)\_V1_200909 contains hardcoded WiFi driver credentials including a RADIUS shared secret, WPS test key, and default PSK embedded in the production firmware…](https://agentprime.io/advisories/CVE-2026-36616.md) `CVE-2026-36616` · CVE record · CVSS 5.9 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: Hard-coded credentials, CWE-1188 - [Mercusys AC12G (EU) V1 router with firmware AC12G(EU)\_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode.](https://agentprime.io/advisories/CVE-2026-36606.md) `CVE-2026-36606` · CVE record · CVSS 7.1 High · Not analysed yet · Published 3 Jun 2026 · Tags: Hard-coded credentials - [Dräger SC Monitoring Devices Hard-coded Credentials and DoS](https://agentprime.io/advisories/CVE-2019-25722.md) `CVE-2019-25722` · CVE record: Dräger SC 6002XL and 4 more · CVSS 7.2 High · Not analysed yet · Published 2 Jun 2026 · Tags: Hard-coded credentials - [Hard-coded credentials in KS-SOMED](https://agentprime.io/advisories/CVE-2026-42251.md) `CVE-2026-42251` · CVE record: KAMSOFT KS-SOMED · CVSS 8.7 High · Not analysed yet · Published 1 Jun 2026 · Tags: Hard-coded credentials - [Credential Exposure Vulnerability in Trac PDBM](https://agentprime.io/advisories/CVE-2026-25600.md) `CVE-2026-25600` · CVE record: Trac d.o.o. PDBM · CVSS 6.4 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Hard-coded credentials - [Apache Solr has hardcoded credentials in the Basic Authentication setup tool](https://agentprime.io/advisories/GHSA-qhr7-h655-pw6r.md) `GHSA-qhr7-h655-pw6r`, `BIT-solr-2026-44825`, `CVE-2026-44825` · Maven `org.apache.solr:solr-core`: affected `>=9.4.0, <=9.10.1`, no fixed version yet · CVSS 8.1 High · Not analysed yet · Published 1 Jun 2026 · Tags: Hard-coded credentials, CWE-1188 - [AgenticMail API/storage and outbound relay hardening fixes](https://agentprime.io/advisories/GHSA-wjjv-3mj2-39hf.md) `GHSA-wjjv-3mj2-39hf`, `CVE-2026-47255` · npm `@agenticmail/api` and 1 more: affected `<0.9.32`, fixed in `0.9.32` · CVSS 8.2 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection, Broken access control, Weak cryptography or TLS, Hard-coded credentials - [Unencrypted storage of authentication state in StrongDM Desktop Application state.kv file](https://agentprime.io/advisories/CVE-2026-4387.md) `CVE-2026-4387` · CVE record: StrongDM StrongDM Desktop Application and 1 more · CVSS 2.0 Low · Not analysed yet · Published 29 May 2026 · Tags: Information disclosure, Hard-coded credentials - [Insufficiently protected credentials in JetBrains TeamCity](https://agentprime.io/advisories/CVE-2026-49379.md) `CVE-2026-49379` · CVE record: JetBrains TeamCity · CVSS 6.5 Medium · Not analysed yet · Published 29 May 2026 · Tags: Hard-coded credentials - [MacGregor Voyage Data Recorder (VDR) G4e Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-42929.md) `CVE-2026-42929` · CVE record: Danelec MacGregor Voyage Data Recorder (VDR) G4e · CVSS 8.7 High · Not analysed yet · Published 29 May 2026 · Tags: Hard-coded credentials - [MacGregor Voyage Data Recorder (VDR) G4e Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2026-42951.md) `CVE-2026-42951` · CVE record: Danelec MacGregor Voyage Data Recorder (VDR) G4e · CVSS 5.9 Medium · Not analysed yet · Published 29 May 2026 · Tags: Hard-coded credentials - [Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-7786.md) `CVE-2026-7786` · CVE record: Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2026 · Tags: Hard-coded credentials - [Dokploy: Pre-Auth Admin Takeover via Hardcoded Authentication Secret](https://agentprime.io/advisories/CVE-2026-45631.md) `CVE-2026-45631` · CVE record: Dokploy dokploy · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2026 · Tags: Hard-coded credentials - [FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface](https://agentprime.io/advisories/CVE-2026-46376.md) `CVE-2026-46376` · CVE record: FreePBX security-reporting · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2026 · Tags: Hard-coded credentials - [Indian Scout Bobber 2025 WCM-to-ECM weak authentication](https://agentprime.io/advisories/CVE-2026-49323.md) `CVE-2026-49323` · CVE record: Indian Motorcycle Scout Bobber + Tech · CVSS 4.1 Medium · Not analysed yet · Published 29 May 2026 · Tags: Weak cryptography or TLS, Hard-coded credentials, Authentication bypass - [Acer Wave 7 router: Hardcoded Cryptographic Key](https://agentprime.io/advisories/CVE-2026-49201.md) `CVE-2026-49201` · CVE record: Acer Wave 7 router · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2026 · Tags: Hard-coded credentials - [RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation](https://agentprime.io/advisories/CVE-2026-45039.md) `CVE-2026-45039` · CVE record: rustfs rustfs · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2026 · Tags: Hard-coded credentials, CWE-1392 - [RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery](https://agentprime.io/advisories/CVE-2026-45041.md) `CVE-2026-45041` · CVE record: rustfs rustfs · CVSS 8.7 High · Not analysed yet · Published 28 May 2026 · Tags: Hard-coded credentials - [SDMC NE6037 Hardcoded Password via mgmt.php/npcmd.php](https://agentprime.io/advisories/CVE-2026-24444.md) `CVE-2026-24444` · CVE record: SDMC Technology Co., Ltd NE6037 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2026 · Tags: Hard-coded credentials - [Use of Weak Credentials in D-Link DWR-X1820 router](https://agentprime.io/advisories/CVE-2026-4377.md) `CVE-2026-4377` · CVE record: D-Link Corporation DWR-X1820 · CVSS 6.0 Medium · Not analysed yet · Published 28 May 2026 · Tags: Hard-coded credentials - [IBM Operations Analytics - Log Analysis is affected by Weak Password Policy and Inadequate Account Lockout Mechanism](https://agentprime.io/advisories/CVE-2024-40684.md) `CVE-2024-40684` · CVE record: IBM Operations Analytics - Log Analysis · CVSS 5.9 Medium · Not analysed yet · Published 27 May 2026 · Tags: Hard-coded credentials - [IBM Controller is affected by vulnerabilities](https://agentprime.io/advisories/CVE-2026-5065.md) `CVE-2026-5065` · CVE record: IBM Controller · CVSS 8.8 High · Not analysed yet · Published 27 May 2026 · Tags: Hard-coded credentials - [Use of Weak Credentials in Slican telephone exchanges](https://agentprime.io/advisories/CVE-2026-35089.md) `CVE-2026-35089` · CVE record: Slican IPx and 3 more · CVSS 8.7 High · Not analysed yet · Published 27 May 2026 · Tags: Hard-coded credentials - [Insufficiently protected credentials in Synology Surveillance Station](https://agentprime.io/advisories/CVE-2024-47271.md) `CVE-2024-47271` · CVE record: Synology Surveillance Station · CVSS 4.9 Medium · Not analysed yet · Published 27 May 2026 · Tags: Hard-coded credentials - [Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2026-2255.md) `CVE-2026-2255` · CVE record: Hitachi Vantara Pentaho Data Integration and Analytics · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Hard-coded credentials - [@hapi/wreck leaks sensitive \`Proxy-Authorization\` header across cross-hostname redirects](https://agentprime.io/advisories/GHSA-vhjm-w67q-g75c.md) `GHSA-vhjm-w67q-g75c`, `CVE-2026-44979` · npm `@hapi/wreck`: affected `<18.1.1`, fixed in `18.1.1` · CVSS 6.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Information disclosure, Hard-coded credentials - [Netis AC1200 Router NC21 V4.0.1.4296 contains a hard-coded root credential stored in /etc/shadow.sample.](https://agentprime.io/advisories/CVE-2026-36538.md) `CVE-2026-36538` · CVE record · CVSS 7.3 High · Not analysed yet · Published 27 May 2026 · Tags: Hard-coded credentials - [Eppendorf BioFlo 320 Use of hard-coded password](https://agentprime.io/advisories/CVE-2026-7251.md) `CVE-2026-7251` · CVE record: Eppendorf BioFlo 320 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 May 2026 · Tags: Hard-coded credentials - [Besen BS20 EV Charging Station BLE/UDP insufficiently protected credentials](https://agentprime.io/advisories/CVE-2026-9395.md) `CVE-2026-9395` · CVE record: Besen BS20 EV Charging Station · CVSS 5.1 Medium · Not analysed yet · Published 24 May 2026 · Tags: Hard-coded credentials - [Besen BS20 EV Charging Station Bluetooth Low Energy weak password](https://agentprime.io/advisories/CVE-2026-9394.md) `CVE-2026-9394` · CVE record: Besen BS20 EV Charging Station · CVSS 2.3 Low · Not analysed yet · Published 24 May 2026 · Tags: Hard-coded credentials - [TypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpoint](https://agentprime.io/advisories/CVE-2026-39968.md) `CVE-2026-39968` · CVE record: baptisteArno typebot.io · CVSS 7.1 High · Not analysed yet · Published 22 May 2026 · Tags: Broken access control, Hard-coded credentials - [Open ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in tables.php](https://agentprime.io/advisories/CVE-2026-48245.md) `CVE-2026-48245` · CVE record: Open ISES Tickets · CVSS 6.9 Medium · Not analysed yet · Published 21 May 2026 · Tags: Hard-coded credentials - [Open ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in settings.inc.php](https://agentprime.io/advisories/CVE-2026-48244.md) `CVE-2026-48244` · CVE record: Open ISES Tickets · CVSS 6.9 Medium · Not analysed yet · Published 21 May 2026 · Tags: Hard-coded credentials - [Open ISES Tickets < 3.44.2 Hardcoded WhitePages API Key in wp1.php](https://agentprime.io/advisories/CVE-2026-48243.md) `CVE-2026-48243` · CVE record: Open ISES Tickets · CVSS 6.9 Medium · Not analysed yet · Published 21 May 2026 · Tags: Hard-coded credentials - [Open ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in import_mdb.php](https://agentprime.io/advisories/CVE-2026-48242.md) `CVE-2026-48242` · CVE record: Open ISES Tickets · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 May 2026 · Tags: Hard-coded credentials - [Open ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in loader.php](https://agentprime.io/advisories/CVE-2026-48241.md) `CVE-2026-48241` · CVE record: Open ISES Tickets · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 May 2026 · Tags: Hard-coded credentials Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .